CVE-2026-48152

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.0

Description Budibase is an open-source low-code platform where the GET and PUT routes for single-datasources are guarded by generic TABLE READ permissions instead of Builder/Admin permissions or datasource-specific ownership checks. Because the built-in Basic app user role maps to the WRITE permission set (which includes table read/write and query write), a Basic user can read a REST datasource and receive redacted authConfigs values. By submitting an update that modifies only the config.url while maintaining the redacted placeholders, the mergeConfigs() function restores the original stored secret. When a saved relative-path REST query is subsequently triggered via the POST /api/v2/queries/{queryId} endpoint, Budibase prefixes the attacker-controlled config.url to the query path and applies the stored authorization headers. This results in the server-side disclosure of the builder-configured REST Authorization secret to an external listener controlled by the attacker.

Recommendations Update Budibase to version 3.39.0. As a temporary mitigation, restrict the use of the PUT /api/datasources/{datasourceId} and GET /api/datasources/{datasourceId} endpoints to only Builder or Admin roles. Rotate REST datasource authorization secrets for affected deployments after applying the update.